Mailing List Archive For snort-sigs@snort.org Aug 2003 By Thread

• Re: [Snort-sigs] I don't want scan.log Dan Monjar (Fri Aug 29 2003 - 13:14:07 EDT)
• Re: [Snort-sigs] I don't want scan.log Mann E. Schevitz (Thu Aug 28 2003 - 15:16:37 EDT)
• Re: [Snort-sigs] Classification.config frenzy(at)frenzy.org (Fri Aug 29 2003 - 11:58:20 EDT)
• Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Vincent Vono (Fri Aug 29 2003 - 09:48:32 EDT)
• Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Johnathan Norman (Fri Aug 29 2003 - 08:50:34 EDT)
• [Snort-sigs] Real Networks vulnerability J-H. Johansen (Fri Aug 29 2003 - 07:06:07 EDT)
• Re: [Snort-sigs] syn/fin scans from stream4 Erek Adams (Fri Aug 29 2003 - 02:38:25 EDT)
• Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Brian Howard (Fri Aug 29 2003 - 00:41:36 EDT)
• Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman (Thu Aug 28 2003 - 21:58:40 EDT)
• Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman (Thu Aug 28 2003 - 21:30:37 EDT)
• RE: [Snort-sigs] syn/fin scans from stream4 Perry, Brian (Thu Aug 28 2003 - 14:49:01 EDT)
• [Snort-sigs] syn/fin scans from stream4 Vincent Vono (Thu Aug 28 2003 - 14:05:56 EDT)
• [Snort-sigs] I don't want scan.log Dan Monjar (Thu Aug 28 2003 - 11:33:48 EDT)
• [Snort-sigs] MS-SQL Ping false positives David Wilburn (Thu Aug 28 2003 - 06:10:27 EDT)
• [Snort-sigs] rule / doc change needed for CyberKit David Wilburn (Thu Aug 28 2003 - 05:59:57 EDT)
• Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams (Thu Aug 28 2003 - 03:12:32 EDT)
• Re: [Snort-sigs] Limiting Alert Rates? Newbie Tony Lill (Wed Aug 27 2003 - 20:00:52 EDT)
• RE: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Compton, Rich (Wed Aug 27 2003 - 16:42:32 EDT)
• Re: [Snort-sigs] Limiting Alert Rates? Newbie Richard Crane (Wed Aug 27 2003 - 10:05:17 EDT)
• RE: [Snort-sigs] Limiting Alert Rates? Newbie Michael Miller (Wed Aug 27 2003 - 10:09:29 EDT)
• [Snort-sigs] Classification.config Williams, Colby E. (Tue Aug 26 2003 - 10:55:37 EDT)
• Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams (Tue Aug 26 2003 - 17:50:59 EDT)
• [Snort-sigs] Limiting Alert Rates? Newbie Jacob Roberts (Tue Aug 26 2003 - 15:32:15 EDT)
• Re: [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com (Mon Aug 25 2003 - 03:33:07 EDT)
• Re: [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart (Sat Aug 23 2003 - 22:37:28 EDT)
• [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart (Sat Aug 23 2003 - 21:48:44 EDT)
• [Snort-sigs] Quick Nachi ICMP rule Paul Schmehl (Fri Aug 22 2003 - 20:50:28 EDT)
• [Snort-sigs] Quick Sobig.f rule Paul Schmehl (Fri Aug 22 2003 - 19:14:35 EDT)
• Re: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com (Fri Aug 22 2003 - 16:51:42 EDT)
• Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknownkeyword 'established' in rule! Wes Young (Thu Aug 21 2003 - 10:17:11 EDT)
• [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com (Fri Aug 22 2003 - 09:41:28 EDT)
• [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com (Fri Aug 22 2003 - 16:20:53 EDT)
• [Snort-sigs] rule 1882 broken Bob Tito (Fri Aug 22 2003 - 12:16:33 EDT)
• Re: [Snort-sigs] Rule for Sobig.F Hugo van der Kooij (Fri Aug 22 2003 - 10:29:36 EDT)
• Re: [Snort-sigs] Rule for Sobig.F Jonathan Norman (Fri Aug 22 2003 - 09:50:58 EDT)
• [Snort-sigs] Event log Signature for Slammer John Hally (Wed Aug 20 2003 - 20:33:52 EDT)
• RE: [Snort-sigs] Lovegate Signature larosa, vjay (Wed Aug 20 2003 - 08:23:35 EDT)
• [Snort-sigs] Lovegate Signature mos def (Wed Aug 20 2003 - 06:04:37 EDT)
• Re: [Snort-sigs] Updated BLASTER TFTP rules Brian (Wed Aug 20 2003 - 00:49:52 EDT)
• Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (Wed Aug 20 2003 - 00:27:38 EDT)
• Re: [Snort-sigs] Updated BLASTER TFTP rules Erick Mechler (Tue Aug 19 2003 - 23:24:36 EDT)
• Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (Tue Aug 19 2003 - 23:39:27 EDT)
• Re: [Snort-sigs] Updated BLASTER TFTP rules Brian (Wed Aug 20 2003 - 00:21:31 EDT)
• [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (Tue Aug 19 2003 - 19:52:27 EDT)
• [Snort-sigs] Rule for Sobig.F Shane Williams (Tue Aug 19 2003 - 17:30:20 EDT)
• Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Chris Green (Tue Aug 19 2003 - 08:56:15 EDT)
• Re: [Snort-sigs] Snorting without "flow:" Chris Green (Tue Aug 19 2003 - 08:58:01 EDT)
• [Snort-sigs] SID 1250 James Affeld (Tue Aug 19 2003 - 03:00:37 EDT)
• RE: (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Nega tive? Bartholomew, Brian J (Mon Aug 18 2003 - 08:17:24 EDT)
• RE: [Snort-sigs] problem writing rules for checking traffic and content mad.eye(at)gmx.net (Tue Aug 19 2003 - 02:21:23 EDT)
• [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (Mon Aug 18 2003 - 23:33:38 EDT)
• [Snort-sigs] Snorting without "flow:" Sean Batt (Mon Aug 18 2003 - 23:23:35 EDT)
• [Snort-sigs] Marek Stiefenhofer ist nicht im Büro m.stiefenhofer(at)ecofis.de (Mon Aug 18 2003 - 22:00:10 EDT)
• Re: [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Hugo van der Kooij (Mon Aug 18 2003 - 18:21:41 EDT)
• RE: [Snort-sigs] problem writing rules for checking traffic and c ontent Eric Baur (Mon Aug 18 2003 - 16:58:41 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Keith T. Morgan (Mon Aug 18 2003 - 15:15:46 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Bryan Irvine (Mon Aug 18 2003 - 14:04:12 EDT)
• [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (Mon Aug 18 2003 - 13:44:37 EDT)
• [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Steve Postma (Mon Aug 18 2003 - 13:46:16 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Yackley, Matt (Mon Aug 18 2003 - 13:03:23 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Robert Wagner (Mon Aug 18 2003 - 12:56:56 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Gavin Lowe (Mon Aug 18 2003 - 13:26:08 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. (Mon Aug 18 2003 - 13:19:51 EDT)
• RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. (Mon Aug 18 2003 - 13:29:39 EDT)
• Re: [Snort-sigs] Q about uricontent vs content ; web bot name Dale L. Handy (Mon Aug 18 2003 - 13:04:11 EDT)
• [Snort-sigs] Strange CyberKit alert activity David Stubblefield (Mon Aug 18 2003 - 12:36:36 EDT)
• [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Jukka Juslin (Mon Aug 18 2003 - 09:29:34 EDT)
• [Snort-sigs] problem writing rules for checking traffic and content studentmm08.pool-id(at)daimlerchrysler.com (Mon Aug 18 2003 - 08:37:53 EDT)
• [Snort-sigs] 1378 sig docs Neal Timm (Sun Aug 17 2003 - 22:31:41 EDT)
• [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (Sun Aug 17 2003 - 23:35:37 EDT)
• RE: [Snort-sigs] Blaster Alert-False Negative? Jade E. Deane (Sun Aug 17 2003 - 15:07:22 EDT)
• [Snort-sigs] Q about uricontent vs content ; web bot name Michael Scheidell (Sun Aug 17 2003 - 09:30:48 EDT)
• [Snort-sigs] Re: Is it possible to Log Headers not Data? Stuart Jenkins (Sat Aug 16 2003 - 04:59:37 EDT)
• [Snort-sigs] Is it possible to Log Headers not Data? Stuart Jenkins (Sat Aug 16 2003 - 04:48:31 EDT)
• [Snort-sigs] GPL/Open Source: Naieve Question Vkmobile (Thu Aug 14 2003 - 16:53:10 EDT)
• Re: [Snort-sigs] snorting telnet caffeinex36(at)yahoo.com (Fri Aug 15 2003 - 18:41:58 EDT)
• [Snort-sigs] snorting telnet Bryan Irvine (Fri Aug 15 2003 - 18:04:29 EDT)
• Re: [Snort-sigs] GPL/Open Source: Naieve Question James Riden (Thu Aug 14 2003 - 18:32:32 EDT)
• Re: [Snort-sigs] Possible new trojan Matt Kettler (Thu Aug 14 2003 - 19:58:15 EDT)
• [Snort-sigs] Blaster/Lovosan Rules Gregor Domhan (Thu Aug 14 2003 - 10:13:26 EDT)
• (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Negative? JP Vossen (Fri Aug 15 2003 - 16:56:53 EDT)
• [Snort-sigs] Web Traffic Logging Travis Rodak (Fri Aug 15 2003 - 16:18:12 EDT)
• [Snort-sigs] tftp msblast.exe rule Kaufman, Adam (Fri Aug 15 2003 - 15:43:06 EDT)
• RE: [Snort-sigs] Blaster Alert-False Negative? lordchariot(at)earthlink.net (Thu Aug 14 2003 - 12:42:15 EDT)
• Re: [Snort-sigs] Blaster Alert-False Negative? Michael Scheidell (Thu Aug 14 2003 - 11:22:29 EDT)
• RE: [Snort-sigs] Can someone please repost a sig for MS Blaster? Parker, Ian (Thu Aug 14 2003 - 11:41:24 EDT)
• Re: [Snort-sigs] Blaster Alert-False Negative? James Riden (Thu Aug 14 2003 - 10:34:50 EDT)
• [Snort-sigs] Blaster Alert-False Negative? Bartholomew, Brian J (Wed Aug 13 2003 - 11:10:21 EDT)
• Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Nigel Houghton (Wed Aug 13 2003 - 18:39:48 EDT)
• Re: [Snort-sigs] Sig file for W32.Blaster.Worm? Erick Mechler (Wed Aug 13 2003 - 17:53:24 EDT)
• [Snort-sigs] Sig file for W32.Blaster.Worm? Jason Antonacci (Wed Aug 13 2003 - 16:25:46 EDT)
• Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Joe Stewart (Wed Aug 13 2003 - 15:47:08 EDT)
• Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Erick Mechler (Wed Aug 13 2003 - 15:26:57 EDT)
• Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com (Wed Aug 13 2003 - 15:03:26 EDT)
• Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? daniel uriah clemens (Wed Aug 13 2003 - 10:02:39 EDT)
• Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Alex Burger (Wed Aug 13 2003 - 14:37:19 EDT)
• [Snort-sigs] Can someone please repost a sig for MS Blaster? Eric Joe (Wed Aug 13 2003 - 13:48:32 EDT)
• [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com (Wed Aug 13 2003 - 14:15:50 EDT)
• RE: [Snort-sigs] fault positives Joshua Wright (Wed Aug 13 2003 - 08:48:25 EDT)
• Re: [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert Jason (Wed Aug 13 2003 - 08:54:15 EDT)
• [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com (Wed Aug 13 2003 - 05:21:15 EDT)
• RE: FW: [Snort-sigs] DCom RPC attack response sig Sewell, Michael K (Tue Aug 12 2003 - 21:12:20 EDT)
• [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com (Wed Aug 13 2003 - 08:10:17 EDT)
• Re: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg (Wed Aug 13 2003 - 03:31:43 EDT)
• Re: FW: [Snort-sigs] DCom RPC attack response sig Bennett Todd (Tue Aug 12 2003 - 14:54:07 EDT)
• RE: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg (Tue Aug 12 2003 - 14:36:39 EDT)
• RE: FW: [Snort-sigs] DCom RPC attack response sig Tech (Tue Aug 12 2003 - 13:18:58 EDT)
• [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert IntegPatchMgr (Tue Aug 12 2003 - 07:17:32 EDT)
• Re: FW: [Snort-sigs] DCom RPC attack response sig Pogue (Tue Aug 12 2003 - 01:56:29 EDT)
• [Snort-sigs] src or dst port alejandro corletti (Mon Aug 11 2003 - 12:09:54 EDT)
• [Snort-sigs] Blaster Worm Signature?? DasPadre(at)aol.com (Tue Aug 12 2003 - 10:18:13 EDT)
• [Snort-sigs] RE: Snort-sigs digest, Vol 1 #670 - 1 msg Vuppala, Vijaybhasker (EM, GECIS) (Tue Aug 12 2003 - 02:13:25 EDT)
• Re: [Snort-sigs] DCom RPC attack response sig CK Ng (Thu Aug 07 2003 - 22:39:10 EDT)
• Re: [Snort-sigs] Signature Timestamp? JP Vossen (Sat Aug 09 2003 - 00:54:27 EDT)
• Re: [Snort-sigs] Signature Timestamp? Dusty Hall (Fri Aug 08 2003 - 09:19:12 EDT)
• [Snort-sigs] RE: Snort-sigs digest, Vol 1 #667 - 4 msgs SG-Chew Poh Chang (Thu Aug 07 2003 - 23:43:05 EDT)
• Re: [Snort-sigs] Signature Timestamp? Matt Kettler (Thu Aug 07 2003 - 17:21:27 EDT)
• [Snort-sigs] Signature Timestamp? Dusty Hall (Thu Aug 07 2003 - 10:08:49 EDT)
• [Snort-sigs] AIM Express sigs Alan Kloster (Thu Aug 07 2003 - 09:30:54 EDT)
• Re: [Snort-sigs] Snort rules am attaching the files Nigel Houghton (Wed Aug 06 2003 - 21:42:49 EDT)
• [Snort-sigs] Documentation: sid 1791 Steven Alexander (Wed Aug 06 2003 - 16:58:37 EDT)
• Re: [Snort-sigs] Snort rules am attaching the files Erek Adams (Wed Aug 06 2003 - 16:40:43 EDT)
• [Snort-sigs] Compaq Insight Management Agent Rich Adamson  (Wed Aug 06 2003 - 12:21:33 EDT)
• [Snort-sigs] Snort Sigs Documents Neal Timm (Wed Aug 06 2003 - 10:06:18 EDT)
• Re: [Snort-sigs] RESERVED IP and Broadcast address Michael Scheidell (Wed Aug 06 2003 - 06:24:16 EDT)
• [Snort-sigs] RESERVED IP and Broadcast address Peter Millington (Wed Aug 06 2003 - 05:04:29 EDT)
• RE: [Snort-sigs] DCom RPC attack response sig Michael Anuzis (Tue Aug 05 2003 - 19:41:40 EDT)
• [Snort-sigs] [Fwd: Re: [Dragonidsuser] W32/Mimail Signature] Burak DAYIOGLU (Wed Aug 06 2003 - 02:53:29 EDT)
• [Snort-sigs] Rule Update Altrock, Jens (Fri Aug 01 2003 - 04:24:25 EDT)
• [Snort-sigs] Sig for Grim's Ping FTP scanner tool JP Vossen (Sat Aug 02 2003 - 02:01:49 EDT)
• [Snort-sigs] More DCOM sigs JP Vossen (Fri Aug 01 2003 - 14:38:25 EDT)
• [Snort-sigs] Robin Smits/NL/GTS/PwC is out of the office. robin.smits(at)nl.pwc.com (Fri Aug 01 2003 - 09:43:10 EDT)